Descripción del puesto / Funciones

- Regularly monitor, triage, and prioritize vulnerabilities in third-party dependencies, libraries, and frameworks.

- Analyze security findings from SAST, DAST, and SCA tools (such as SonarQube, Checkmarx, OWASP ZAP, and Dependabot).

- Implement and automate processes for dependency updates, vulnerability detection, and remediation within CI/CD pipelines and container environments (like OpenShift).

- Document vulnerability assessments, remediation activities, and compliance evidence using tools like Jira and vulnerability management platforms.

- Develop and enforce secure coding guidelines, dependency management standards, and best practices.

- Report on vulnerability status, remediation progress, and risk trends to stakeholders and security leadership.

- Support incident response related to critical vulnerabilities, including zero-day exploits and high-severity CVEs.

- Ensure adherence to internal policies and external regulations (such as ISO 27001, NIST, GDPR, and SOC 2).

Requisitos mínimos

- Familiarity with cloud security principles (AWS, Azure, GCP) and container security practices.

- Professional certifications such as CISSP, OSCP, CEH, or CCSP.

- Experience with vulnerability management platforms (Tenable, Qualys, Rapid7) and compliance standards.

- Experience: Minimum of 3 years of expertise in software security, vulnerability management, or related fields.





- Tools & Technologies:
- Vulnerability detection and management tools (SAST, DAST, SCA such as SonarQube, Checkmarx, OWASP ZAP, and Dependabot).

- Dependency management across multiple ecosystems (npm, Maven, pip, NuGet, or Go modules).

- Container orchestration and security (OpenShift and Docker).

- Version control systems (Git, GitHub) and issue tracking tools (Jira).

- Skills & Knowledge:

- Proficiency in scripting and automation (Python, Bash) for integrating security processes into CI/CD workflows.

- Deep understanding of vulnerabilities (OWASP Top 10, CWE) and CVSS scoring methodology.

- Experience implementing security best practices within DevOps pipelines and cloud environments.

- Strong analytical and problem-solving skills.

Requisitos valorables

- Familiarity with cloud security principles (AWS, Azure, GCP) and container security practices.

- Professional certifications such as CISSP, OSCP, CEH, or CCSP.

- Experience with vulnerability management platforms (Tenable, Qualys, Rapid7) and compliance standards.

Idiomas

English is a must

Ubicación

Barcelona

¿Quiénes somos?

Pasiona Consulting es una consultora tecnológica, partner de Microsoft, dedicada al diseño, desarrollo e implementación de aplicaciones de software a medida para clientes de múltiples sectores.

📌 Vulnerability Management Expert (Barcelona)
🏢 Trabajos en Demo Datos
📍 Barcelona